Disk Full on Linux: Find What Is Using Space

Disk Full on Linux: How to Find What Is Using the Space

When a Linux server says No space left on device, find the culprit before deleting anything: df -h shows which filesystem is full, and sudo du -xh / --max-depth=1 | sort -h shows which folder is big. It is almost always one of five things: application or web server logs, the systemd journal, Docker images and container logs, package caches, or a deleted file a program still holds open. Each has a safe way to clear it, below.

1. Which Disk Is Full?

df -h          # space, per filesystem
df -i          # inodes (number of files), per filesystem

Look at the Use% column for / and anything else near 100%. If space looks fine but IUse% is at 100%, see the FAQ about inodes.

2. Which Folder Is Big?

sudo du -xh / --max-depth=1 2>/dev/null | sort -h | tail -15
sudo du -xh /var --max-depth=1 2>/dev/null | sort -h | tail -15

Follow the biggest folder down a level at a time. -x keeps du on one filesystem, so it does not wander into mounted storage. For a faster, interactive view, use ncdu and browse with the arrow keys:

sudo apt install -y ncdu
sudo ncdu -x /

To find single large files:

sudo find / -xdev -type f -size +500M -exec ls -lh {} + 2>/dev/null

3. The systemd Journal

journalctl --disk-usage
sudo journalctl --vacuum-size=200M

To keep it there, set SystemMaxUse=200M in /etc/systemd/journald.conf and run sudo systemctl restart systemd-journald.

4. Application and Web Server Logs

Old rotated logs can go. A log that is still being written should be emptied, not deleted:

sudo find /var/log -type f \( -name "*.gz" -o -name "*.[0-9]" \) -delete
sudo truncate -s 0 /var/log/nginx/access.log

If one app's log keeps growing, give it a logrotate rule (a file in /etc/logrotate.d/) so it is rotated and compressed automatically.

5. Docker

docker system df                      # what Docker is using
docker image prune -a                 # images no container uses
docker builder prune                  # build cache
sudo du -sh /var/lib/docker/containers/*/*-json.log | sort -h | tail

Huge *-json.log files are container logs with no size limit. Do not run docker volume prune unless you are sure: volumes hold your data. How to run Docker on a VPS shows how to cap log sizes so it does not happen again.

6. Package Caches and Old Kernels

sudo apt clean
sudo apt autoremove --purge

7. Deleted Files Still Held Open

If df says full but du cannot find the space, a program is holding a deleted file open:

sudo lsof +L1

Restart the service named in the first column, and the space is released.

Stop It Happening Again

A check that warns you at 80% beats finding out at 100%. Even a daily cron job that emails when df passes a threshold is enough. Move backups off the server rather than keeping them on the same disk: see How to back up a Linux server with Borg.

Common Questions

Why does df say the disk is full when du finds much less?

A deleted file still takes space while a program has it open, usually a log a service is still writing to. sudo lsof +L1 lists them; restart that service and the space comes back.

Why does it say “No space left on device” when df shows free space?

The disk has run out of inodes, the slots that each file needs, usually because of millions of tiny files such as sessions or cache entries. df -i shows inode use; find the folder with the most files and clear it.

Is it safe to delete files in /var/log?

Old, rotated logs (ending in .1, .gz and so on) are safe to delete. Do not delete a log a service is writing to; empty it instead with sudo truncate -s 0 on the file, so the service keeps writing to the same file.

Can I make the disk bigger instead?

Yes. A bigger plan comes with a bigger disk. Find out what grew first, though: a log or cache that fills one disk will fill a bigger one too, only later.